It looks to me like Synaptic is no longer using the “su”/“sudo” mechanism, but switched to “PolicyKit” instead.PolicyKit is based on “actions” with which authorisation rules are associated.

I’m not particularly familiar with PolicyKit, so I will have to dig a little deeper into this issue.For starters, when you start the Synaptic Package Manager, you should see an authentication window that asks you for a password.Close to the bottom left of the window, you should see a “Details” entry. If you click on that, you will be shown the PolicyKit action that synaptic requests—it should be “com.ubuntu.pkexec.synaptic”. Since synaptic prompts you for your own password, instead of the “root” one, there must be some PolicyKit configuration file set up to that effect.

Could you run the following command, to see which PolicyKit configuration files set up the “com.ubuntu.pkexec.synaptic” action? Run this as “root”, since some of the directories will not be accessible otherwise:

As far as I know, the selection between "su" and "sudo" mode for "gksu" can be made either for the system or for the individual user. How to do it for the system has been described earlier in this thread:

Now, I am quite certain that in Jessie, the user default mode for "gksu" was to use "su" mode. In Stretch I believe this has been changed to use the "sudo" mode. It may be in the documentation somewhere but I have simply noticed it.

(gksu-properties:3744): GConf-WARNING **: Client failed to connect to the D-BUS daemon:Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.GConf Error: No D-BUS daemon running

(gksu-properties:3744): GConf-WARNING **: Client failed to connect to the D-BUS daemon:Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.GConf Error: No D-BUS daemon running

(gksu-properties:3744): GConf-WARNING **: Client failed to connect to the D-BUS daemon:Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.GConf Error: No D-BUS daemon running

(gksu-properties:3744): GConf-WARNING **: Client failed to connect to the D-BUS daemon:Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.GConf Error: No D-BUS daemon running